Feature story from Slovenia: Infographics as a tool to present IT audit findings – a case study

As captivating as IT audit reports are, the uninitiated frequently find them less than exciting. Infographics have proven to be an excellent tool to help readers understand key IT audit findings and promote our work. This article highlights our approach to the graphic presentation of an IT audit and its findings on a case study: "IT support for Centres for Social Work".

The problem area

Social services in the Republic of Slovenia are organised through a network of independent Centres for Social Work (hereafter referred to as CSW), whose tasks include processing and deciding on parental, social and disability claims. The Ministry of Labour, Family, Social Affairs and Equal Opportunities (hereafter referred to as the Ministry) has been trying to design the benefits process to be as automatic as possible by developing a unified CSW information system.

Social benefits represent more than 10 percent of the total public budget in the Republic of Slovenia. The CSW system has affected the lives of almost all residents of the country.

The audit

Due to its importance, the Court of Audit of the Republic of Slovenia audits the CSW information system every couple of years. In our last audit, which covered the period from January 2014 to December 2019 we have specifically focused on whether the Ministry has been efficient in its IT support for the CSWs. The audit revealed several persistent issues:

• the Ministry had great difficulties answering even basic questions such as how many beneficiaries receive any specific social benefit and how much they receive, despite the budgetary impact of social benefits;
• the Ministry was directly or indirectly responsible for at least 50 regulatory changes and has only twice appropriately planned their impact on the CSW information system;
• combined with inadequate project-management practices this led to a hodgepodge of semi-working solutions and workarounds and unclear responsibilities for various IT related tasks;
• the pre-prepared social claims' decisions were (and still are) almost unreadable and not user-friendly due to errors in their templates. Therefore the CSW and CSW workers were burdened with numerous unnecessary tasks, such as re-writing them to at least a resemblance of logic.

 
The challenge

The Court of Audit is committed to clear and transparent reporting to the public. The highly technical nature of IT audits, however, makes this quite challenging. Infographics are an excellent tool to help the public understand IT audit findings. To make the subject matter compelling, we have developed some best practices, that we try to follow in this type of audits.

Have it done by the experts

Although our auditors have been known to dabble in infographics in the past, professional designers specialized in data visualization, joining our team has really upped our game. Our team of design experts ensures that:

• a unified visual language is being consistently followed in all our documents,
• difficult concepts are presented in the infographics so that they are understandable and transparent to different audiences – not just to the experts,
• through multidisciplinary collaboration auditors are more encouraged and motivated to find new, original ways of presenting information.

Less is more

Presenting an 80-page audit report on up to 5 slides requires serious focus. The auditor must resist the urge to pack the slides with too much information or to increase the number of slides.

A statistical representation of the problem area

What data will give the readers enough context to understand the basic background and why should this subject matter to them?

Although all our audits include representation of the audited area through data, planning an infographic requires collecting types of data, which can be easily visualized and are interesting for the reader. Examples of some IT audit data with great visualization potential include:

• Data depicting the "size" of the information system: number of work stations, active users, external users e.g. citizens, locations, servers, etc.
• Data depicting the "size" of the information system's operations: number of claims, processed in a given period, number of records, logical size of the records, etc.
• Estimation of the effects of the information system's: work time saved, wait-time reduction, customer satisfaction, etc.
• IT Key Performance Indicators: uptime, total operating time, mean time between failures, number of security incidents, response time to security incidents, etc.

In the case of the audit "IT support for CSWs" we have decided to focus on depicting the "size" of the information system's operations (picture 1) both through its impact on social workers, as well as through its budgetary impact.

It is important that the auditor considers what data will be needed for a compelling infographic early in the audit process. These data frequently include content data on the subject area, supported by the information system that an IT auditor typically might not gather.

Picture 1: Short description and visualisation of the size of CSWs operations

The whole truth … and nothing but

Audit findings are seldom black and white. The public is likely to get most of their information from the infographics and the auditor must be extremely careful that the nuance is not lost. The only way to ensure this is the use of qualifiers. In our example, the Ministry needed five attempts to provide us with plausible data on the most basic social benefits statistics, such as the number of beneficiaries for a single right. Although this strongly indicates that the Ministry did not appropriately analyse their data and has, for a number of years, relied on incorrect data, we could not actually prove this assumption. Although the original assumption would be more eye-catching in the context of an infographic, the nuance had to be preserved thus qualifiers had to be used. We did however still highlight our concern area visually (picture 2).

Picture 2: Audit findings

Make it relatable

Legally binding decisions on social and parental benefits, issued by our CSWs, are extremely confusing documents. The CSW's information system contains pre-prepared templates for most of these documents. The complex legislation, numerous types of benefits, their interdependencies, various claimant-related factors such as income and assets owned combined with frequent regulatory changes have left these templates hopelessly out of date, full of illogically combined paragraphs, and irrelevant or outdated legal references. It is extremely difficult for a non-expert to understand the language of CSWs' decisions. We have used this well-known frustration by depicting it in our infographic. We also pointed out the loss of efficiency this situation presents for the social workers, who lose valuable hours working around these errors (picture 3).

Picture 3: Frustrating CSW legally binding documentation

Audit opinion and follow-up activities

As a supreme audit institution, it is only appropriate, that we conclude by presenting our findings and potential follow-up activities.

Picture 4: Audit opinion and follow-up activities

Conclusion

Presenting our findings in the form of infographics has increased the media coverage of our audits and improved our public communication. Pages from the infographic IT support for Centres for Social Work have also been used by all the major media in the Republic of Slovenia.

More examples of our work can be found on our web page: https://www.rs-rs.si/en/.

By

Maja Hmelak, M.Sc., CISA, CIA

IT auditor at the Court of Audit of the Republic of Slovenia

Aleksandra Vugrin, M.A.

Visual communications designer at the Court of Audit of the Republic of Slovenia